A plurality of network nodes are deployed in a network, each network node configured to apply a service function to traffic that passes through the respective network nodes. A controller generates information for a service chain that involves application to traffic of one or more service functions at corresponding ones of the plurality of network nodes along a forward path through the one or more network nodes. The controller identifies one or more of the service functions within the service chain that is stateful. When one or more of the service functions of the service chain is stateful, the controller generates information for a reverse path through the one or more service nodes for the one or more stateful service functions. The controller binds a forward chain identifier for the forward path with a reverse chain identifier for the reverse path for the service chain.
|
1. A method comprising:
in a network comprising a plurality of network nodes each configured to apply a service function to traffic that passes through the respective network nodes, a controller generating information for a first service chain that involves application to traffic of one or more service functions at corresponding ones of the plurality of network nodes along a forward path through the one or more network nodes, wherein the generated information for the first service chain including a forward chain identifier that identifies all service functions and their respective locations along the forward path;
identifying one or more of the service functions within the first service chain that are stateful and require flow state information be maintained such that forward traffic flows and reverse traffic flows be forwarded through same functions at same locations;
when one or more of the service functions of the first service chain are stateful and require flow state information be maintained such that forward traffic flows and reverse traffic flows be forwarded through same functions at same locations, generating information for a second service chain through the one or more network nodes for the one or more stateful service functions in a reverse path, wherein the generated information for the second service chain including a reverse chain identifier that identifies all service functions and their respective locations along the reverse path; and
binding the forward chain identifier for the first service chain with the reverse chain identifier for the second service chain.
16. One or more non-transitory computer readable storage media encoded with software comprising computer executable instructions and when the software is executed operable to:
generate information for a first service chain that involves application to traffic of one or more service functions at corresponding ones of a plurality of network nodes along a forward path through the one or more network nodes, each of the plurality of network nodes configured to apply a service function to traffic that passes through it, wherein the generated information for the first service chain including a forward chain identifier that identifies all service functions and their respective locations along the forward path;
identify one or more of the service functions within the service chain that are stateful and require flow state information be maintained such that forward traffic flows and reverse traffic flows be forwarded through same functions at same locations;
when one or more of the service functions of the service chain are stateful and require flow state information be maintained such that forward traffic flows and reverse traffic flows be forwarded through same functions at same locations, generate information for a second service chain through the one or more network nodes for the one or more stateful service functions in a reverse path, wherein the generated information for the second service chain including a reverse chain identifier that identifies all service functions and their respective locations along the reverse path; and
bind the forward chain identifier for the first service chain with the reverse chain identifier for the second service chain.
9. An apparatus comprising:
a network interface unit configured to enable communications over a network, the network comprising a plurality of network nodes each configured to apply a service function to traffic that passes through the respective network nodes;
memory; and
a processor coupled to the network interface unit and the memory, wherein the processor is configured to:
generate information for a first service chain that involves application to traffic of one or more service functions at corresponding ones of the plurality of network nodes along a forward path through the one or more network nodes, wherein the generated information for the first service chain including a forward chain identifier that identifies all service functions and their respective locations along the forward path;
identify one or more of the service functions within the first service chain that are stateful and require flow state information be maintained such that forward traffic flows and reverse traffic flows be forwarded through same functions at same locations;
when one or more of the service functions of the first service chain are stateful and require flow state information be maintained such that forward traffic flows and reverse traffic flows be forwarded through same functions at same locations, generate information for a second service chain through the one or more network nodes for the one or more stateful service functions in a reverse path, wherein the generated information for the second service chain including a reverse chain identifier that identifies all service functions and their respective locations along the reverse path; and
generate information to bind the forward chain identifier for the first service chain with the reverse chain identifier for the second service chain.
2. The method of
3. The method of
4. The method of
5. The method of
6. The method of
7. The method of
8. The method of
10. The apparatus of
11. The apparatus of
12. The apparatus of
13. The apparatus of
14. The apparatus of
15. The apparatus of
17. The non-transitory computer readable storage media of
18. The non-transitory computer readable storage media of
19. The non-transitory computer readable storage media of
20. The non-transitory computer readable storage media of
|
|||||||||||||||||||||||||||||
The present disclosure relates to networking for service chains.
Today's network services are becoming more and more complex. In many cases a service is constructed as a chain of independent service functions that follow an ordered sequence of execution. Such service chains are unidirectional in nature, i.e., traffic is forwarded through the chain in a single direction. The forwarding policy for a service chain is carried in the data plane using a service header. The service header is used to specify the service chain details (order of service functions that to be applied to packets, and optionally location/status of these service functions) as well as context information used in the application of the service.
While unidirectional service chains are useful, their current structure is unable to fully satisfy the requirements of stateful Internet Protocol (IP) services. Such services require that traffic be forwarded through the same set of service functions (at the exact same location) in both directions: client-to-server and server-to-client.
Presented herein are techniques to enable automated association and binding of forward/reverse service chains and the bi-directional traffic flows of stateful services, e.g., stateful Internet Protocol (IP) services. A plurality of network nodes are deployed in a network, each network node configured to apply a service function to traffic that passes through it. A controller generates information for a service chain that involves application to traffic of one or more service functions at corresponding ones of the plurality of network nodes along a forward path through the one or more network nodes. The controller identifies one or more of the service functions within the service chain that is stateful. When one or more of the service functions of the service chain is stateful, the controller generates information for a reverse path through the one or more network nodes for the one or more stateful service functions. The controller binds a forward chain identifier for the forward path with a reverse chain identifier for the reverse path for the service chain.
A service chain consists of an entry point node (also called a head-end node) and an ordered list of service functions and their physical network location, represented as [service-function, service-location] tuples, which are to be executed on packets that are forwarded through the chain of service locations, also called network nodes or service nodes. Individual service functions referenced by the service chain may be deployed at multiple points in a network topology dependent upon redundancy and horizontal service scaling requirements. The association between a service chain and the physical location of each individual service function is referenced using a globally unique service-chain-id. A network node (or service node) is a network device, such as a router, switch, gateway etc., that has a server blade or other computing device coupled to it, which server blade or computing device is configured with applicable software capability to execute one or more services on network traffic that is directed to that network node. The network nodes may be physical or virtual network elements.
Packet forwarding through a service chain is unidirectional. The head-end node acts as a packet classifier interface into the service chain (determining which traffic flows require redirection into the service chain and which do not) imposing the necessary service header (containing the service-chain-id) and the transport encapsulation to force the traffic flow to the first service function at the appropriate network location as specified in the service chain structure. For example, service-chain-idx may be specified as:
Service-chain-idx=[head-end-node1], [service-function1, service-location1], [service-function2, service-location2]
Stateful IP services (firewall, network address translation (NAT), Deep Packet Inspection (DPI), intrusion detection services (IDS), etc.) require that flow state information be maintained and forward/reverse traffic flows be forwarded through the same service functions at the same locations.
The unidirectional service chain for this example service is specified as follows.
Servicex=[head-end-node1], [service-function1, service-location22], [service-function2, service-location2], [service-function3, service-location57], where service-function3 is an IP stateful service function.
The structure of the service chain forces traffic that is classified at [head-end-node1] 20 as belonging to Servicex to be forwarded into the service chain before being sent off net. As service-function3 is an IP stateful service function it is necessary that return traffic be passed back through service-function3 located at service-location57 because this location holds all the necessary service state information. This reverse path forwarding requirement cannot be facilitated with current state-of-the-art techniques as they do not allow for an automated association of the forward/reverse traffic flows of a given service chain. Therefore, the operator must manually configure the system to explicitly identify the forward/reverse service chains and ensure that the appropriate service-chain-id's are correctly mapped to the relevant network nodes.
Presented herein are techniques for automation of the forward/reverse traffic flows on a per service chain basis. For each unidirectional service chain, an identification/determination is made as to whether one or more of the service functions within the chain is stateful. If a positive identification of a stateful service function is made, then an additional service-chain-id is created to represent the reverse path of the service chain, and the reverse path of the service chain is bound to the unidirectional service chain used in the forward direction. The automated binding may be based on a range of attributes (e.g. class name, flow details, SDN controller knowledge, etc.). The resultant binding creates a forward-chain-id and a reverse-chain-id association for the service chain:
Servicex=service chain association {forward-chain-idx, reverse-chain-idx} where: forward-chain-idx=[service-function1, service-location22], [service-function2, service-location2], [service-function3, service-location57]; and
Reverse-chain-idx=[service-function3, service-location57]
Thus, the binding consists of generating data representing the association of the forward-chain-id and the reverse-chain-id for a service chain. Using this association, the service chain infrastructure as well as the service function software can correlate traffic flows in both directions, with each service hop involved in the forwarding of packets for a given service chain holding the association and programmed by a central service orchestration platform. The correct service-chain-id pairs are presented for symmetric encapsulation as well as bound together at each network node involved in the service chain. In addition, the association of symmetric service-chain-id's enables network nodes that proxy/terminate sessions between clients and servers to send responses of the proxied sessions arriving on the forward-chain-id, as an example, to the reverse-chain-id to reach the session originator.
At an orchestration layer in a cloud management platform, a service is defined, (for example secure web hosting), that when decomposed, defines (in addition to many other elements) specific L4-L7 service functions, service metrics and associated selection/attachment criteria (i.e. tenant, class of traffic, flow, etc.). These services and associated metrics are sent to the controller 10 for service selection, graph creation and rendering.
Active service functions are registered with the controller 10. Registration may involve the controller 10 receiving notifications of all active service functions among the plurality of network nodes, each notification including information describing service function capabilities. Post-service function registration, the controller 10 has a view of all available service functions within the service domain and their locations, e.g. network location, Internet Protocol/Media Access Control (IP/MAC) addresses, as well as, if needed, topological placement e.g. [data center1, rack1]. Additionally, network nodes publish their service function capabilities, e.g. [service-function1 is an application firewall, symmetry is required and can process 500 sessions], [service-function2 is an IP firewall, symmetry is required and can handle 200,000 sessions] and so on. The controller 10 maintains a catalog of services, and the associated service functions that comprise them (a service may consist of a single or multiple service functions), that can be instantiated as needed, with similar attributes. This catalog of services comprises data describing attributes of all active service functions, and from this data the controller 10 generates information for a service chain by selecting necessary service functions and their associated network nodes for the service chain from the stored data. The controller 10 also identifies which one or more service functions in the service chain are stateful. For example, the controller may store information indicating that it has an image for a server load balancer, that this type of load balancer requires y amount of central processor units (CPU) and memory to run, and is capable of Secure Socket Layer (SSL) offload at the rate of n packets per second.
During service chain creation, the controller 10 selects all the necessary service functions and their locations and a service path graph is created. During path definition, symmetry requirements are defined as well. At this point, the service infrastructure has, in addition to a view of available service functions, a series of service paths, both forward and reverse (if required) coupled and the associated classification criteria (tenant, flow, etc.).
The controller 10 generates a service header that represents the summarized view of this service chain. The previous Servicex example may be represented as follows:
Servicex=service chain association {forward-chain-idx, reverse-chain-idx} where:
forward-chain-idx=[service-function1, service-location22], [service-function2, service-location2], [service-function3, service-location57]; and
Reverse-chain-idx=[service-function3, service-location57]
The controller 10 generates the service header and generates classification criteria of the service chain, and as explained further hereinafter, sends the service header and the classification criteria for the service chain to the one or more network nodes.
Reference is now made to
Traffic in the forward direction is classified by the head-end node (classifier1) and directed into service chain forward-chain-idx. Reverse traffic may appear at any peering router and therefore a network orchestration platform applies classification rules that are able to intercept the reverse traffic and then classify it as requiring treatment through service chain reverse-chain-idx. In prior systems, the two service chains and headers are viewed as separate distinct elements, whereas in the techniques presented herein, both the forward and reverse chains are formed at the same time with knowledge and binding of the relationship between them.
The service headers allocated for the service chain are pushed to the forwarding and service infrastructure. Head-end nodes impose these headers based on policy (e.g. tenant1 traffic is coming from virtual routing forwarding (VRF) function x) and then forwards matching traffic into the service chain. Each network node within the service chain uses the header information to impose policy and forward packets to the next hop. The reverse path, already programmed in all elements, follows the same logic.
Reference is now made to
Service-chain-id's may be generated when a traffic flow is configured at a centralized controller, or this generation may be tied to more network-centric functions such as Authentication, Authorization and Accounting (AAA), Network Based Application Recognition (NBAR), and Deep Packet Inspection (DPI).
Turning now to
Furthermore, as described above in connection with
In summary, when packets traverse a list of services, called a service chain, symmetry is required to ensure that stateful services (e.g., stateful IP services) are processed in both the forward and reverse traffic flow directions, and in the correct order. Using the techniques presented herein, service headers used for service chaining are automatically created and allocated to support the required traffic flow symmetry.
These techniques facilitate orchestration and automated correlation and association of traffic flows in both forward and reverse directions. There are several advantages associated with these techniques.
Network provisioning. This is simplified since there is no need to associate unrelated headers at the edge of the network. Service chains are pseudo bi-directional.
Service provisioning. One of the challenges with the existing model for services is service policy attachment. Without the techniques presented herein, two unrelated headers need to be correlated on the network nodes for policy application. Using these techniques, given that both headers are allocated a priori and their symmetric relationship is known, they are conveyed to the network nodes simultaneously and bound to the appropriate policy.
Management. System management/orchestration no longer needs to correlate between independent service headers to determine service topology. Using these techniques, the symmetric headers are paired and the association is clear and conveyed to upper layer systems, greatly simplifying automated provisioning.
Troubleshooting. As with management, troubleshooting tools (or people) no longer need to correlate service headers to understand service path flows. Rather, the two symmetric headers are clearly coupled and communicated to the diagnostic tools.
The symmetric headers allow for consistent header allocation, and consistent policy application per service, in both directions without external correlation. This ensures that the correct service policy is applied. This also allows proxied services to send messages/responses to the correct chain of service functions in both directions (forward and reverse).
Turning now to
The memory 320 may comprise read only memory (ROM), random access memory (RAM), magnetic disk storage media devices, optical storage media devices, flash memory devices, electrical, optical, or other physical/tangible memory storage devices. In general, the memory 320 may comprise one or more tangible (non-transitory) computer readable storage media (e.g., a memory device) encoded with software comprising computer executable instructions and when the software is executed (by the processor 310) it is operable to perform the operations described herein.
Thus, the techniques presented herein may be embodied in a method, an apparatus and computer readable storage media, for example. In method form, the method involves, in a network comprising a plurality of network nodes each configured to apply a service function to traffic that passes through the respective network nodes, a controller generating information for a service chain that involves application to traffic of one or more service functions at corresponding ones of the plurality of network nodes along a forward path through the one or more network nodes; identifying one or more of the service functions within the service chain that is stateful; when one or more of the service functions of the service chain is stateful, generating information for a reverse path through the one or more network nodes for the one or more stateful service functions; and binding a forward chain identifier for the forward path with a reverse chain identifier for the reverse path for the service chain.
In apparatus form, an apparatus is provided comprising a network interface unit configured to enable communications over a network, the network comprising a plurality of network nodes each configured to apply a service function to traffic that passes through the respective network nodes; memory; and a processor coupled to the network interface unit and the memory, wherein the processor is configured to: generate information for a service chain that involves application to traffic of one or more service functions at corresponding ones of the plurality of network nodes along a forward path through the one or more network nodes; identify one or more of the service functions within the service chain that is stateful; when one or more of the service functions of the service chain is stateful, generate information for a reverse path through the one or more network nodes for the one or more stateful service functions; and generate information to bind a forward chain identifier for the forward path with a reverse chain identifier for the reverse path for the service chain.
In computer readable storage media form, one or more computer readable storage media are provided encoded with software comprising computer executable instructions and when the software is executed operable to: generate information for a service chain that involves application to traffic of one or more service functions at corresponding ones of a plurality of network nodes along a forward path through the one or more network nodes, each of the plurality of network nodes configured to apply a service function to traffic that passes through it; identify one or more of the service functions within the service chain that is stateful; when one or more of the service functions of the service chain is stateful, generate information for a reverse path through the one or more network nodes for the one or more stateful service functions; and bind a forward chain identifier for the forward path with a reverse chain identifier for the reverse path for the service chain.
Described above are examples. The concepts described herein may be embodied in other specific forms without departing from the spirit or essential characteristics thereof. The foregoing examples are therefore to be considered in all respects illustrative and not meant to be limiting. Accordingly, it is intended to embrace all such alterations, modifications and variations that fall within the spirit and scope of any claims filed in applications claiming priority hereto interpreted in accordance with the breadth to which they are fairly, legally and equitably entitled.
Fang, Luyuan, Ward, David, Guichard, James, Quinn, Paul, Bosch, Hendrikus G. P., Fernando, Rex, Sharma, Govind P.
| Patent | Priority | Assignee | Title |
| 10158561, | May 10 2013 | Cisco Technology, Inc. | Data plane learning of bi-directional service chains |
| 10476790, | Dec 19 2016 | Cisco Technology, Inc.; Cisco Technology, Inc | Service chaining at a network device |
| 10965596, | Oct 04 2017 | Cisco Technology, Inc | Hybrid services insertion |
| 10965598, | Oct 04 2017 | Cisco Technology, Inc. | Load balancing in a service chain |
| 11082312, | Oct 04 2017 | Cisco Technology, Inc. | Service chaining segmentation analytics |
| Patent | Priority | Assignee | Title |
| 7558261, | Oct 28 2004 | Cisco Technology, Inc. | Architecture and method for accessing services in a data center |
| 7571470, | Oct 28 2004 | Cisco Technology, Inc. | One arm data center topology with layer 4 and layer 7 services |
| 7610375, | Oct 28 2004 | Cisco Technology, Inc. | Intrusion detection in a data center environment |
| 7643468, | Oct 28 2004 | Cisco Technology, Inc. | Data-center network architecture |
| 7657940, | Oct 28 2004 | Cisco Technology, Inc. | System for SSL re-encryption after load balance |
| 8311045, | Apr 07 2006 | Cisco Technology, Inc. | System and method for selectively applying a service to a network packet using a preexisting packet header |
| 8442043, | Dec 29 2008 | Cisco Technology, Inc. | Service selection mechanism in service insertion architecture data plane |
| 20060092950, | |||
| 20060095960, | |||
| 20080177896, | |||
| 20090037713, | |||
| 20100165985, | |||
| 20140215560, | |||
| 20140307744, |
| Executed on | Assignor | Assignee | Conveyance | Frame | Reel | Doc |
| May 01 2013 | GUICHARD, JAMES | Cisco Technology, Inc | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 030391 | /0787 | |
| May 01 2013 | SHARMA, GOVIND P | Cisco Technology, Inc | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 030391 | /0787 | |
| May 01 2013 | WARD, DAVID | Cisco Technology, Inc | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 030391 | /0787 | |
| May 02 2013 | FANG, LUYUAN | Cisco Technology, Inc | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 030391 | /0787 | |
| May 03 2013 | QUINN, PAUL | Cisco Technology, Inc | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 030391 | /0787 | |
| May 03 2013 | BOSCH, HENDRIKUS G P | Cisco Technology, Inc | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 030391 | /0787 | |
| May 05 2013 | FERNANDO, REX | Cisco Technology, Inc | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 030391 | /0787 | |
| May 10 2013 | Cisco Technology, Inc. | (assignment on the face of the patent) | / |
| Date | Maintenance Fee Events |
| Aug 09 2019 | M1551: Payment of Maintenance Fee, 4th Year, Large Entity. |
| Aug 07 2023 | M1552: Payment of Maintenance Fee, 8th Year, Large Entity. |
| Date | Maintenance Schedule |
| Feb 09 2019 | 4 years fee payment window open |
| Aug 09 2019 | 6 months grace period start (w surcharge) |
| Feb 09 2020 | patent expiry (for year 4) |
| Feb 09 2022 | 2 years to revive unintentionally abandoned end. (for year 4) |
| Feb 09 2023 | 8 years fee payment window open |
| Aug 09 2023 | 6 months grace period start (w surcharge) |
| Feb 09 2024 | patent expiry (for year 8) |
| Feb 09 2026 | 2 years to revive unintentionally abandoned end. (for year 8) |
| Feb 09 2027 | 12 years fee payment window open |
| Aug 09 2027 | 6 months grace period start (w surcharge) |
| Feb 09 2028 | patent expiry (for year 12) |
| Feb 09 2030 | 2 years to revive unintentionally abandoned end. (for year 12) |